claim-snortertokens[.]pages[.]dev

The domain claim‑snortertokens.pages.dev is currently active and resolves to the Cloudflare‑owned address 172.66.47.45. The site returns HTTP 200 and presents the page title “Snorter Token Crypto Trading Bot | Best Crypto Presale,” indicating a crypto‑draining campaign. Infrastructure analysis shows the domain is hosted behind Cloudflare with HSTS, HTTP/3, Google Tag Manager, and standard Cloudflare security headers enabled. The domain was registered on 2026‑02‑21 and uses the Cloudflare‑provided nameservers kenia.ns.cloudflare.com and jaziel.ns.cloudflare.com. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, one security blocklist lists the domain, and PhishDestroy has already blocked it. VirusTotal reports a single vendor detection out of 95 scans, confirming at least one security product flags the site as malicious. No additional technical artifacts such as payload hashes or command‑and‑control endpoints are disclosed in the available intelligence, so the exact malicious behavior beyond the advertised crypto trading bot remains unverified. Defenders should treat the domain as high‑risk: block DNS resolution for claim‑snortertokens.pages.dev, deny outbound connections to its IP address, and monitor for any traffic to Cloudflare edge nodes that may be used to relay malicious scripts. Continuous re‑scanning with updated threat‑intelligence feeds is recommended to capture any emerging indicators, and any internal alerts referencing the page title or similar crypto‑drain language should be escalated for further investigation.